OCSP responder auditing settings changed or disabled

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.

Known false positives

Rare PKI/ADCS/OSCP admin changes

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5123: A configuration entry changed in the OCSP Responder Service.

Rule body

title: OCSP responder auditing settings changed or disabled
description: Detects scenarios where an attacker would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.
requirements: requires to have the OCSP role installed and to have enabled auditing in the responder properties.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1222.001-File%20and%20Directory%20Permissions%20Modification
- https://www.gradenegger.eu/en/overview-of-the-audit-events-generated-by-the-online-responder-ocsp/
- https://services.google.com/fh/files/misc/active-directory-certificate-services-hardening-wp-en.pdf
- https://speakerdeck.com/heirhabarov/hunting-for-active-directory-certificate-services-abuse
- https://www.crowdstrike.com/wp-content/uploads/2023/12/investigating-active-directory-certificate-abuse.pdf
tags:
- attack.defense_evasion
- attack.t1562.002 # Impair Defenses: Disable or Modify Tools 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5123
    PropertyName: AuditFilter
  condition: selection
falsepositives:
- Rare PKI/ADCS/OSCP admin changes
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 5123
  PropertyName: AuditFilter

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PropertyName`	eq	`AuditFilter`	`field:"PropertyName" kind:eq value:"AuditFilter"`